{"id":86563,"date":"2020-06-27T01:42:01","date_gmt":"2020-06-26T23:42:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-curl-7-71-0-s-ustraneniem-dvuh-uyazvimostej"},"modified":"2020-06-27T01:42:01","modified_gmt":"2020-06-26T23:42:01","slug":"vypusk-curl-7-71-0-s-ustraneniem-dvuh-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/vypusk-curl-7-71-0-s-ustraneniem-dvuh-uyazvimostej","title":{"rendered":"Lan\u00e7amento do curl 7.71.0 com duas vulnerabilidades corrigidas","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/curl.haxx.se\/mail\/archive-2020-06\/0055.html\">Dispon\u00edvel<\/a><\/noindex> nova vers\u00e3o da ferramenta para obter e enviar dados pela rede \u2014 <noindex><a rel=\"nofollow\" href=\"https:\/\/curl.haxx.se\/\">curl 7.71.0<\/a><\/noindex>, que permite a forma\u00e7\u00e3o flex\u00edvel de solicita\u00e7\u00f5es com a defini\u00e7\u00e3o de par\u00e2metros como cookie, user_agent, referer e quaisquer outros cabe\u00e7alhos. cURL suporta HTTP, HTTPS, HTTP\/2.0, HTTP\/3, SMTP, IMAP, POP3, Telnet, FTP, LDAP, RTSP, RTMP e outros protocolos de rede. Ao mesmo tempo, foi lan\u00e7ada uma atualiza\u00e7\u00e3o da biblioteca libcurl, que fornece uma API para utilizar todas as fun\u00e7\u00f5es do curl em programas em linguagens como C, Perl, PHP, Python. <\/p>\n<p>A nova vers\u00e3o adicionou a op\u00e7\u00e3o \u00ab\u2014retry-all-errors\u00bb para tentar novamente a execu\u00e7\u00e3o de opera\u00e7\u00f5es quando ocorrem quaisquer erros e corrigiu duas vulnerabilidades:<\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openwall.com\/lists\/oss-security\/2020\/06\/24\/2\">Vulnerabilidade<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/curl.haxx.se\/docs\/CVE-2020-8177.html)\">CVE-2020-8177<\/a><\/noindex> permite sobrescrever um arquivo local no sistema ao acessar um servidor controlado por um atacante. O problema se manifesta apenas quando as op\u00e7\u00f5es \u00ab-J\u00bb (\u00ab\u2014remote-header-name\u00bb) e \u00ab-i\u00bb (\u00ab\u2014head\u00bb) s\u00e3o usadas simultaneamente. A op\u00e7\u00e3o \u00ab-J\u00bb permite salvar o arquivo com o nome especificado no cabe\u00e7alho<br \/>\n\u00abContent-Disposition\u00bb. Caso um arquivo com esse nome j\u00e1 exista, o programa curl normalmente se recusa a sobrescrever, mas quando a op\u00e7\u00e3o \u00ab-i\u00bb est\u00e1 presente, a l\u00f3gica de verifica\u00e7\u00e3o \u00e9 violada e o arquivo \u00e9 sobrescrito (a verifica\u00e7\u00e3o ocorre na fase de recebimento do corpo da resposta, mas com a op\u00e7\u00e3o \u00ab-i\u00bb, primeiro os cabe\u00e7alhos HTTP s\u00e3o exibidos e eles s\u00e3o salvos antes do in\u00edcio do processamento do corpo da resposta). Apenas os cabe\u00e7alhos HTTP s\u00e3o gravados, mas o servidor pode devolver dados arbitr\u00e1rios em vez dos cabe\u00e7alhos e esses dados ser\u00e3o salvos.<\/p>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openwall.com\/lists\/oss-security\/2020\/06\/24\/1\">Vulnerabilidade<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/curl.haxx.se\/docs\/CVE-2020-8169.html\">CVE-2020-8169<\/a><\/noindex>  pode levar a uma vazamento no servidor DNS de algumas senhas de acesso ao site (Basic, Digest, NTLM etc.). Ao usar o s\u00edmbolo \u00ab@\u00bb na senha, que tamb\u00e9m \u00e9 utilizado como delimitador de senha na URL, quando ocorre um redirecionamento HTTP, o curl enviar\u00e1 parte da senha ap\u00f3s o s\u00edmbolo \u00ab@\u00bb junto com o dom\u00ednio para determinar o nome. Por exemplo, ao especificar a senha \u00abpassw@rd123\u00bb e o nome de usu\u00e1rio \u00abdan\u00bb, o curl gerar\u00e1 a URL \u00abhttps:\/\/dan:passw@rd123@example.com\/path\u00bb em vez de \u00abhttps:\/\/dan:passwrd123@example.com\/path\u00bb e enviar\u00e1 uma solicita\u00e7\u00e3o para resolver o host \u00abrd123@example.com\u00bb em vez de \u00abexample.com\u00bb.\n<p>O problema ocorre ao ativar o suporte a redirecionamentos HTTP relativos (desativados atrav\u00e9s de CURLOPT_FOLLOWLOCATION). No caso de uso de DNS tradicionais, informa\u00e7\u00f5es sobre parte da senha podem ser obtidas pelo provedor de DNS e por atacantes que t\u00eam a capacidade de interceptar o tr\u00e1fego de rede em tr\u00e2nsito (mesmo que a solicita\u00e7\u00e3o original tenha sido feita via HTTPS, uma vez que o tr\u00e1fego DNS n\u00e3o \u00e9 criptografado). Ao utilizar DNS-over-HTTPS (DoH), o vazamento \u00e9 limitado ao operador de DoH.<\/p>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Fonte: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53239\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0435\u0442\u0438 &#8212; curl 7.71.0, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0433\u0438\u0431\u043a\u043e\u0433\u043e \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0441 \u0437\u0430\u0434\u0430\u043d\u0438\u0435\u043c \u0442\u0430\u043a\u0438\u0445 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432, \u043a\u0430\u043a cookie, user_agent, referer \u0438 \u043b\u044e\u0431\u044b\u0445 \u0434\u0440\u0443\u0433\u0438\u0445 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432. cURL \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 HTTP, HTTPS, HTTP\/2.0, HTTP\/3, SMTP, IMAP, POP3, Telnet, FTP, LDAP, RTSP, RTMP \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u044b. \u041e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0432\u044b\u0448\u043b\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-86563","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0435\u0442\u0438 -\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pt\/blog\/news\/vypusk-curl-7-71-0-s-ustraneniem-dvuh-uyazvimostej\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"pt_PT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a curl 7.71.0 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0435\u0442\u0438 -\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pt\/blog\/news\/vypusk-curl-7-71-0-s-ustraneniem-dvuh-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-06-26T23:42:01+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-06-26T23:42:01+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Lan\u00e7amento do curl 7.71.0 com a corre\u00e7\u00e3o de duas vulnerabilidades | ProHoster","description":"Est\u00e1 dispon\u00edvel uma nova vers\u00e3o da ferramenta para obter e enviar dados pela rede -","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/vypusk-curl-7-71-0-s-ustraneniem-dvuh-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a curl 7.71.0 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0435\u0442\u0438 -","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/vypusk-curl-7-71-0-s-ustraneniem-dvuh-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-26T23:42:01+00:00","article:modified_time":"2020-06-26T23:42:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"86563","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:13:22","updated":"2022-09-28 00:04:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/86563","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=86563"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/86563\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=86563"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=86563"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=86563"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}